Electronic audit logs are critical for determining compliance to policy in operational procedures. This is especially true when considering electronic procedures of automated processes. By their nature, electronic procedures can be carried out in great numbers, each of which may be critical to the proper operation of an enterprise. Furthermore, automated processes are capable of performing a large number of transactions in a relatively short amount of time. Therefore, if proper operation is not ensured, the problems caused by lack of control may be catastrophic to the enterprise in a short period of time.
For nefarious individuals that seek to commit crimes against an enterprise, subverting electronic procedures is a must in order to effectuate their crimes and obscure or erase their trail, which may detail their activities. For example, one way to obscure a financial transaction is to use a valid identity that is not associated with the perpetrator. For this to work the valid identity must be a type that can legitimately perform the transaction and it must be valid at the time the perpetrator uses it.
One rich source for perpetrators to acquire valid identities is a traditional audit log. These logs are critical to determining compliance to policy of an enterprise's electronic procedures, as mentioned above, but logs also include rich information for intruders if they are located and compromised. That is, conventional audit logs by their very nature provide references to identities associated with a transaction and identities provide a mechanism by which intruders can perpetrate bogus transactions against an enterprise.
Thus, identities, within audit logs, should be preserved and managed in more secure manners.